@unavatar/core 3.46.0 → 3.46.1

package/package.json

@@ -2,7 +2,7 @@
   "name": "@unavatar/core",
   "description": "Get unified user avatar from social networks, including Instagram, SoundCloud, Telegram, Twitter, YouTube & more.",
   "homepage": "https://unavatar.io",
-  "version": "3.46.0",
+  "version": "3.46.1",
   "main": "src/index.js",
   "exports": {
     ".": "./src/index.js",

package/src/avatar/auto.js

@@ -8,6 +8,7 @@ const isEmail = require('is-email-like')
 const pTimeout = require('p-timeout')
 const pAny = require('p-any')
 
+const { RESERVED_ADDRESS_CODE } = require('../util/is-reserved-ip')
 const httpStatus = require('../util/http-status')
 const isIterable = require('../util/is-iterable')
 const ExtendableError = require('../util/error')
@@ -23,9 +24,29 @@ const getInputType = input => {
   return 'username'
 }
 
-const factory = ({ constants, providers, providerTiers, reachableUrl }) => {
+const factory = ({
+  constants,
+  providers,
+  providerTiers,
+  reachableUrl,
+  isReservedIp
+}) => {
   const { REQUEST_TIMEOUT } = constants
 
+  const refuseReservedAddress = provider => {
+    throw new ExtendableError({
+      message: 'The URL points to a reserved address.',
+      provider,
+      statusCode: httpStatus.FORBIDDEN
+    })
+  }
+
+  const assertPublicUrl = async (url, provider) => {
+    if (await isReservedIp(new URL(url).hostname)) {
+      refuseReservedAddress(provider)
+    }
+  }
+
   const getAvatarContent = provider => async output => {
     if (typeof output !== 'string' || output === '') {
       const message =
@@ -49,7 +70,12 @@ const factory = ({ constants, providers, providerTiers, reachableUrl }) => {
       })
     }
 
-    const { statusCode, url } = await reachableUrl(output)
+    await assertPublicUrl(output, provider)
+
+    const { statusCode, url, reservedAddress } = await reachableUrl(output)
+
+    if (reservedAddress) refuseReservedAddress(provider)
+    await assertPublicUrl(url, provider)
 
     if (!reachableUrl.isReachable({ statusCode })) {
       throw new ExtendableError({
@@ -73,6 +99,9 @@ const factory = ({ constants, providers, providerTiers, reachableUrl }) => {
       .then(getAvatarContent(provider))
       .catch(error => {
         isIterable.forEach(error, error => {
+          if (error.code === RESERVED_ADDRESS_CODE) {
+            error.statusCode = httpStatus.FORBIDDEN
+          }
           error.statusCode = error.statusCode ?? error.response?.statusCode
           error.provider = provider
         })

package/src/index.js

@@ -29,23 +29,20 @@ module.exports = ({
     resolver: dnsResolver
   })
   const isReservedIp = require('./util/is-reserved-ip')({ cacheableLookup })
-  const got = require('./util/got')({ cacheableLookup })
+  const got = require('./util/got')({ cacheableLookup, isReservedIp })
   const reachableUrl = require('./util/reachable-url')({
     got,
     pingCache: cache.pingCache
   })
   const createBrowser = require('./util/browserless')(constants)
   const getHTML = require('./util/html-get')({ createBrowser, got })
-  const {
-    createHtmlProvider,
-    getOgImage,
-    NOT_FOUND
-  } = require('./util/html-provider')({
-    ...constants,
-    getHTML,
-    onFetchHTML,
-    userAgent
-  })
+  const { createHtmlProvider, getOgImage, NOT_FOUND } =
+    require('./util/html-provider')({
+      ...constants,
+      getHTML,
+      onFetchHTML,
+      userAgent
+    })
 
   const providerCtx = {
     constants,
@@ -60,15 +57,15 @@ module.exports = ({
     githubSearchCache: cache.githubSearchCache,
     itunesSearchCache: cache.itunesSearchCache
   }
-  const { providers, providerTiers, providersBy } = require('./providers')(
-    providerCtx
-  )
+  const { providers, providerTiers, providersBy } =
+    require('./providers')(providerCtx)
 
   const { auto, getInputType, getAvatar } = require('./avatar/auto')({
     constants,
     providers,
     providerTiers,
-    reachableUrl
+    reachableUrl,
+    isReservedIp
   })
 
   const unavatar = input => auto(getInputType(input))(input, {})

package/src/providers/bimi.js

@@ -4,18 +4,15 @@ const createGetLogo = require('bimi-url')
 
 const parseInput = input => input.slice(input.lastIndexOf('@') + 1)
 
-module.exports = ({ bimiCache, dnsResolver, got, isReservedIp }) => {
+module.exports = ({ bimiCache, dnsResolver, got }) => {
   const getLogo = createGetLogo({
     gotOpts: got.gotOpts,
     keyvOpts: bimiCache,
     resolveTxt: hostname => dnsResolver.resolveTxt(hostname)
   })
 
-  return async function bimi (input) {
-    const logoUrl = await getLogo(parseInput(input))
-    if (!logoUrl) return undefined
-    if (await isReservedIp(new URL(logoUrl).hostname)) return undefined
-    return logoUrl
+  return function bimi (input) {
+    return getLogo(parseInput(input))
   }
 }
 

package/src/util/got.js

@@ -5,6 +5,8 @@ const tlsHook = require('https-tls/hook')
 const uaHints = require('ua-hints')
 const got = require('got')
 
+const { RESERVED_ADDRESS_CODE } = require('./is-reserved-ip')
+
 const topUserAgents = require('top-user-agents')
 const randomUserAgent = uniqueRandomArray(topUserAgents)
 
@@ -36,11 +38,40 @@ const userAgentHook = options => {
   }
 }
 
-module.exports = ({ cacheableLookup }) => {
+module.exports = ({ cacheableLookup, isReservedIp }) => {
+  /**
+   * The refused address is reported on `options.context` because a caller
+   * reading the outcome through `reachable-url` never sees the rejection: it is
+   * swallowed there and served back as a response.
+   *
+   * Only a context the caller owns is written: the one got defaults to is
+   * frozen and shared between requests, so asking to be told is what passing a
+   * context means.
+   *
+   * got replaces the error with a RequestError that keeps the message and the
+   * code, so the refusal is named by a code rather than by its type.
+   */
+  const reservedAddressHook = async options => {
+    const hostname = options.url?.hostname
+    if (hostname && (await isReservedIp(hostname))) {
+      if (Object.isExtensible(options.context)) {
+        options.context.reservedAddress = hostname
+      }
+      const error = new Error(
+        `Refusing to request a reserved address: ${hostname}`
+      )
+      error.code = RESERVED_ADDRESS_CODE
+      throw error
+    }
+  }
+
   const gotOpts = {
     dnsCache: cacheableLookup,
     https: { rejectUnauthorized: false },
-    hooks: { beforeRequest: [userAgentHook, tlsHook] }
+    hooks: {
+      beforeRequest: [reservedAddressHook, userAgentHook, tlsHook],
+      beforeRedirect: [reservedAddressHook]
+    }
   }
 
   const instance = got.extend(gotOpts)

package/src/util/is-reserved-ip.js

@@ -2,16 +2,16 @@
 
 const ip = require('ipaddr.js')
 
+const unbracket = hostname =>
+  hostname.startsWith('[') && hostname.endsWith(']')
+    ? hostname.slice(1, -1)
+    : hostname
+
 module.exports = ({ cacheableLookup }) => {
   const getIpAddress = async hostname => {
     if (ip.IPv4.isIPv4(hostname)) return hostname
-    if (
-      hostname.startsWith('[') &&
-      hostname.endsWith(']') &&
-      ip.IPv6.isIPv6(hostname.slice(1, -1))
-    ) {
-      return hostname.slice(1, -1)
-    }
+    const literal = unbracket(hostname)
+    if (ip.IPv6.isIPv6(literal)) return literal
     const { address } = await cacheableLookup.lookupAsync(hostname)
     return address
   }
@@ -21,3 +21,5 @@ module.exports = ({ cacheableLookup }) => {
     return ip.process(ipAddress).range() !== 'unicast'
   }
 }
+
+module.exports.RESERVED_ADDRESS_CODE = 'ERESERVEDADDRESSRANGE'

package/src/util/reachable-url.js

@@ -7,11 +7,12 @@ module.exports = ({ got, pingCache }) => {
     value: ({ url, statusCode }) => ({ url, statusCode })
   })
 
-  const reachableUrl = (url, opts) =>
-    pingUrl(url, {
-      ...got.gotOpts,
-      ...opts
-    })
+  const reachableUrl = async (url, opts) => {
+    const context = {}
+    const response = await pingUrl(url, { ...got.gotOpts, ...opts, context })
+    const { reservedAddress } = context
+    return reservedAddress ? { ...response, reservedAddress } : response
+  }
 
   reachableUrl.isReachable = createPingUrl.isReachable